CVE-2025-5321

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-5321
A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c Exploit Third Party Advisory
https://vuldb.com/?ctiid.310492 Permissions Required VDB Entry
https://vuldb.com/?id.310492 Third Party Advisory VDB Entry
https://vuldb.com/?submit.580253 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:aimstack:aim:*:*:*:*:*:python:*:*
History

19 Sep 2025, 17:17

Type Values Removed Values Added
CPE cpe:2.3:a:aimstack:aim:*:*:*:*:*:python:*:*
First Time Aimstack
Aimstack aim
References () https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c - () https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.310492 - () https://vuldb.com/?ctiid.310492 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.310492 - () https://vuldb.com/?id.310492 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.580253 - () https://vuldb.com/?submit.580253 - Third Party Advisory, VDB Entry

01 Jun 2025, 05:15

Type Values Removed Values Added
Summary (en) A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Query leads to sandbox issue. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

30 May 2025, 16:31

Type Values Removed Values Added
Summary
  • (es) Se detectó una vulnerabilidad crítica en aimhubio (hasta la versión 3.29.1). Esta vulnerabilidad afecta a la función RestrictedPythonQuery del archivo /aim/storage/query.py del componente run_view Object Handler. La manipulación del argumento "Query" provoca un problema de la sandbox. El ataque puede ejecutarse en remoto. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.

29 May 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-29 15:15

Updated : 2025-09-19 17:17

NVD link : CVE-2025-5321

Mitre link : CVE-2025-5321

CVE.ORG link : CVE-2025-5321

JSON object : View

Products Affected

aimstack

  • aim
CWE
CWE-264

Permissions, Privileges, and Access Controls

CWE-265

Privilege Issues